CVE-2021-36260
Hikvision · exploited in the wild
- Published
- 22 September 2021
- Last modified
- 17 June 2026
- CVSS
- 9.8 v3.1
- Severity
- critical
- EPSS
- 99.9% (100th pct)
- CISA KEV
- Added 10 January 2022 KEV
- NVD status
- Analyzed
- Weaknesses
- CWE-78
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Exploitation
Added to the CISA Known Exploited Vulnerabilities catalogue on 10 January 2022, with a remediation due date of 24 January 2022 for US federal civilian agencies. CISA records no known ransomware campaign use.
Required action as published by CISA: Apply updates per vendor instructions.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| DS-2CD2021G1-I(W) | Hikvision | unknown | — |
| DS-2CD2023G2-I(U) | Hikvision | unknown | — |
| DS-2CD2026G2-IU/SL | Hikvision | unknown | — |
| DS-2CD2027G2-L(U) | Hikvision | unknown | — |
| DS-2CD2027G2-LU/SL | Hikvision | unknown | — |
| DS-2CD2043G2-I(U) | Hikvision | unknown | — |
| DS-2CD2046G2-IU/SL | Hikvision | unknown | — |
| DS-2CD2047G2-L(U) | Hikvision | unknown | — |
| DS-2CD2063G2-I(U) | Hikvision | unknown | — |
| DS-2CD2066G2-I(U) | Hikvision | unknown | — |
| DS-2CD2066G2-IU/SL | Hikvision | unknown | — |
| DS-2CD2083G2-I(U) | Hikvision | unknown | — |
| DS-2CD2086G2-I(U) | Hikvision | unknown | — |
| DS-2CD2086G2-IU/SL | Hikvision | unknown | — |
| DS-2CD2087G2-L(U) | Hikvision | unknown | — |
| DS-2CD2121G0-I(W)(S) | Hikvision | unknown | — |
| DS-2CD2121G1 | Hikvision | unknown | — |
| DS-2CD2121G1-I(W) | Hikvision | unknown | — |
| DS-2CD2121G1-IDW | Hikvision | unknown | — |
| DS-2CD2123G2-I(S) | Hikvision | unknown | — |
| DS-2CD2123G2-IU | Hikvision | unknown | — |
| DS-2CD2127G2-(-SU) | Hikvision | unknown | — |
| DS-2CD2143G2-I(S) | Hikvision | unknown | — |
| DS-2CD2143G2-IU | Hikvision | unknown | — |
| DS-2CD2147G2-L(SU) | Hikvision | unknown | — |
| DS-2CD2163G2-I(S) | Hikvision | unknown | — |
| DS-2CD2163G2-IU | Hikvision | unknown | — |
| DS-2CD2166G2-I(SU) | Hikvision | unknown | — |
| DS-2CD2183G2-I(S) | Hikvision | unknown | — |
| DS-2CD2183G2-I(U) | Hikvision | unknown | — |
| DS-2CD2183G2-IU | Hikvision | unknown | — |
| DS-2CD2186G2-I(SU) | Hikvision | unknown | — |
| DS-2CD2186G2-ISU | Hikvision | unknown | — |
| DS-2CD2321G0-I/NF | Hikvision | unknown | — |
| DS-2CD2323G2-I(U) | Hikvision | unknown | — |
| DS-2CD2326G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD2327G2-L(U) | Hikvision | unknown | — |
| DS-2CD2343G2-I(U) | Hikvision | unknown | — |
| DS-2CD2346G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD2347G2-L(U) | Hikvision | unknown | — |
| DS-2CD2347G2-LSU/SL | Hikvision | unknown | — |
| DS-2CD2363G2-I(U) | Hikvision | unknown | — |
| DS-2CD2366G2-I(U) | Hikvision | unknown | — |
| DS-2CD2366G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD2383G2-I(U) | Hikvision | unknown | — |
| DS-2CD2386G2-I(U) | Hikvision | unknown | — |
| DS-2CD2386G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD2387G2-L(U) | Hikvision | unknown | — |
| DS-2CD2421G0-I(D)(W) | Hikvision | unknown | — |
| DS-2CD2421G0-I(D)W | Hikvision | unknown | — |
| DS-2CD2426G2-I | Hikvision | unknown | — |
| DS-2CD2446G2-I | Hikvision | unknown | — |
| DS-2CD2523G2-I(S) | Hikvision | unknown | — |
| DS-2CD2523G2-I(U) | Hikvision | unknown | — |
| DS-2CD2526G2-I(S) | Hikvision | unknown | — |
| DS-2CD2526G2-IS | Hikvision | unknown | — |
| DS-2CD2527G2-LS | Hikvision | unknown | — |
| DS-2CD2543G2-I(WS) | Hikvision | unknown | — |
| DS-2CD2546G2-I(S) | Hikvision | unknown | — |
| DS-2CD2547G2-LS | Hikvision | unknown | — |
| DS-2CD2547G2-LZS | Hikvision | unknown | — |
| DS-2CD2563G2-I(S) | Hikvision | unknown | — |
| DS-2CD2566G2-I(S) | Hikvision | unknown | — |
| DS-2CD2583G2-I(S) | Hikvision | unknown | — |
| DS-2CD2586G2-I(S) | Hikvision | unknown | — |
| DS-2CD2621G0-I(Z)(S) | Hikvision | unknown | — |
| DS-2CD2623G2-IZS | Hikvision | unknown | — |
| DS-2CD2626G2-IZSU/SL | Hikvision | unknown | — |
| DS-2CD2643G2-IZS | Hikvision | unknown | — |
| DS-2CD2646G2-IZSU/SL | Hikvision | unknown | — |
| DS-2CD2663G2-IZS | Hikvision | unknown | — |
| DS-2CD2666G2-IZS | Hikvision | unknown | — |
| DS-2CD2666G2-IZSU/SL | Hikvision | unknown | — |
| DS-2CD2683G2-IZS | Hikvision | unknown | — |
| DS-2CD2686G2-IZS | Hikvision | unknown | — |
| DS-2CD2686G2-IZSU/SL | Hikvision | unknown | — |
| DS-2CD2721G0-I(Z)(S) | Hikvision | unknown | — |
| DS-2CD2723G2-IZS | Hikvision | unknown | — |
| DS-2CD2743G2-IZS | Hikvision | unknown | — |
| DS-2CD2763G2-IZS | Hikvision | unknown | — |
| DS-2CD2766G2-IZS | Hikvision | unknown | — |
| DS-2CD2783G2-IZS | Hikvision | unknown | — |
| DS-2CD2786G2-IZS | Hikvision | unknown | — |
| DS-2CD3023G2-IU | Hikvision | unknown | — |
| DS-2CD3026G2-IS | Hikvision | unknown | — |
| DS-2CD3026G2-IU/SL | Hikvision | unknown | — |
| DS-2CD3043G2-IU | Hikvision | unknown | — |
| DS-2CD3047G2-LS | Hikvision | unknown | — |
| DS-2CD3056G2-IS | Hikvision | unknown | — |
| DS-2CD3056G2-IU/SL | Hikvision | unknown | — |
| DS-2CD3056G2IU/SL | Hikvision | unknown | — |
| DS-2CD3063G2-IU | Hikvision | unknown | — |
| DS-2CD3086G2-IS | Hikvision | unknown | — |
| DS-2CD3123G2-I(S)U | Hikvision | unknown | — |
| DS-2CD3126G2-IS | Hikvision | unknown | — |
| DS-2CD3126G2-IS(U) | Hikvision | unknown | — |
| DS-2CD3143G2-I(S)U | Hikvision | unknown | — |
| DS-2CD3156G2-IS | Hikvision | unknown | — |
| DS-2CD3156G2-IS(U) | Hikvision | unknown | — |
| DS-2CD3163G2-I(S)U | Hikvision | unknown | — |
| DS-2CD3186G2-IS(U) | Hikvision | unknown | — |
| DS-2CD3323G2-IU | Hikvision | unknown | — |
| DS-2CD3326G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD3343G2-IU | Hikvision | unknown | — |
| DS-2CD3347G2-LS(U) | Hikvision | unknown | — |
| DS-2CD3356G2-IS | Hikvision | unknown | — |
| DS-2CD3356G2-IS(U) | Hikvision | unknown | — |
| DS-2CD3356G2-ISU/SL | Hikvision | unknown | — |
| DS-2CD3363G2-IU | Hikvision | unknown | — |
| DS-2CD3386G2-IS | Hikvision | unknown | — |
| DS-2CD3386G2-IS(U) | Hikvision | unknown | — |
| DS-2CD3523G2-IS | Hikvision | unknown | — |
| DS-2CD3526G2-IS | Hikvision | unknown | — |
| DS-2CD3543G2-IS | Hikvision | unknown | — |
| DS-2CD3547G2-LS | Hikvision | unknown | — |
| DS-2CD3556G2-IS | Hikvision | unknown | — |
| DS-2CD3563G2-IS | Hikvision | unknown | — |
| DS-2CD3586G2-IS | Hikvision | unknown | — |
| DS-2CD3623G2-IZS | Hikvision | unknown | — |
| DS-2CD3626G2-IZS | Hikvision | unknown | — |
| DS-2CD3643G2-IZS | Hikvision | unknown | — |
| DS-2CD3656G2-IZS | Hikvision | unknown | — |
| DS-2CD3663G2-IZS | Hikvision | unknown | — |
| DS-2CD3686G2-IZS | Hikvision | unknown | — |
| DS-2CD3723G2-IZS | Hikvision | unknown | — |
| DS-2CD3726G2-IZS | Hikvision | unknown | — |
| DS-2CD3743G2-IZS | Hikvision | unknown | — |
| DS-2CD3756G2-IZS | Hikvision | unknown | — |
| DS-2CD3763G2-IZS | Hikvision | unknown | — |
| DS-2CD3786G2-IZS | Hikvision | unknown | — |
| DS-2DF5225X-AE3(T3) | Hikvision | unknown | — |
| DS-2DF5225X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF5232X-AE3)T3) | Hikvision | unknown | — |
| DS-2DF5232X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF6A225X-AEL)T3) | Hikvision | unknown | — |
| DS-2DF6A236X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF6A425X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF6A436X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF6A436X-AEL(T5) | Hikvision | unknown | — |
| DS-2DF6A436X-AELY(T5) | Hikvision | unknown | — |
| DS-2DF6A825X-AEL | Hikvision | unknown | — |
| DS-2DF6A836X-AEL(T5) | Hikvision | unknown | — |
| DS-2DF7225IX-AEL(T3) | Hikvision | unknown | — |
| DS-2DF7225IX-AELW(T3) | Hikvision | unknown | — |
| DS-2DF7232IX-AEL(T3) | Hikvision | unknown | — |
| DS-2DF7232IX-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8225IH-AEL | Hikvision | unknown | — |
| DS-2DF8225IH-AEL(W) | Hikvision | unknown | — |
| DS-2DF8225IX-AEL(T3) | Hikvision | unknown | — |
| DS-2DF8225IX-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8225IX-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8225IX-AELW(T5) | Hikvision | unknown | — |
| DS-2DF8236I5X-AELW | Hikvision | unknown | — |
| DS-2DF8242I5X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF8242I5X-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8242I5X-AELW(T5) | Hikvision | unknown | — |
| DS-2DF8242IX-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8242IX-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8242IX-AELY(T3) | Hikvision | unknown | — |
| DS-2DF8250I8X-AEL(T3) | Hikvision | unknown | — |
| DS-2DF8425IX-AEL(T3) | Hikvision | unknown | — |
| DS-2DF8425IX-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8425IX-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8425IX-AELW(T5) | Hikvision | unknown | — |
| DS-2DF8436I5X-AELW(T3) | Hikvision | unknown | — |
| DS-2DF8442IXS-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8442IXS-AELW(T2) | Hikvision | unknown | — |
| DS-2DF8442IXS-AELW(T5) | Hikvision | unknown | — |
| DS-2DF8442IXS-AELWY(T5) | Hikvision | unknown | — |
| DS-2DF8442IXS-AELY(T5) | Hikvision | unknown | — |
| DS-2DF8A442IXS-AEL(T2) | Hikvision | unknown | — |
| DS-2DF8A442IXS-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8A442IXS-AELY(T5) | Hikvision | unknown | — |
| DS-2DF8A442IXS-AF/SP(T5) | Hikvision | unknown | — |
| DS-2DF8A442NXS-AEL(T5) | Hikvision | unknown | — |
| DS-2DF8A842IXS-AEL(T5) | Hikvision | unknown | — |
| DS-2DY9236I8X-A | Hikvision | unknown | — |
| DS-2DY9236I8X-A(T3) | Hikvision | unknown | — |
| DS-2DY9236IX-A(T3) | Hikvision | unknown | — |
| DS-2DY9236X-A(T3) | Hikvision | unknown | — |
| DS-2DY9240IX-A(T5) | Hikvision | unknown | — |
| DS-2DY92500X-A(T5) | Hikvision | unknown | — |
| DS-2DY9250IZS-A(T5) | Hikvision | unknown | — |
| DS-2DYH2A0IXS-D(T2) | Hikvision | unknown | — |
| DS-2TD1117-2/PA | Hikvision | unknown | — |
| DS-2TD1117-3/PA | Hikvision | unknown | — |
| DS-2TD1117-6/PA | Hikvision | unknown | — |
| DS-2TD1217B-3/PA | Hikvision | unknown | — |
| DS-2TD1217B-6/PA | Hikvision | unknown | — |
| DS-2TD4136T-9 | Hikvision | unknown | — |
| DS-2TD4137-25/W | Hikvision | unknown | — |
| DS-2TD4137-50/W | Hikvision | unknown | — |
| DS-2TD4166T-9 | Hikvision | unknown | — |
| DS-2TD4167-25/W | Hikvision | unknown | — |
| DS-2TD4167-50/W | Hikvision | unknown | — |
| DS-2TD6236T-50H2L | Hikvision | unknown | — |
| DS-2TD6237-50H4L/W | Hikvision | unknown | — |
| DS-2TD6237-75C4L/W | Hikvision | unknown | — |
| DS-2TD6266T-25H2L | Hikvision | unknown | — |
| DS-2TD6266T-50H2L | Hikvision | unknown | — |
| DS-2TD6267-100C4L/W | Hikvision | unknown | — |
| DS-2TD6267-100C4L/WY | Hikvision | unknown | — |
| DS-2TD6267-50H4L/W | Hikvision | unknown | — |
| DS-2TD6267-75C4L/W | Hikvision | unknown | — |
| DS-2TD6267-75C4L/WY | Hikvision | unknown | — |
| DS-2TD8166-100C2F/V2 | Hikvision | unknown | — |
| DS-2TD8166-150ZE2F/V2 | Hikvision | unknown | — |
| DS-2TD8166-150ZH2F/V2 | Hikvision | unknown | — |
| DS-2TD8166-180ZE2F/V2 | Hikvision | unknown | — |
| DS-2TD8166-75C2F/V2 | Hikvision | unknown | — |
| DS-2TD8167-150ZC4F/W | Hikvision | unknown | — |
| DS-2TD8167-190ZE2F/W | Hikvision | unknown | — |
| DS-2TD8167-190ZE2F/WY | Hikvision | unknown | — |
| DS-2TD8167-230ZG2F/W | Hikvision | unknown | — |
| DS-2TD8167-230ZG2F/WY | Hikvision | unknown | — |
| DS-2XE6242F-IS/316L(B) | Hikvision | unknown | — |
| DS-2XE6422FWD-IZHRS | Hikvision | unknown | — |
| DS-2XE6442F-IZHRS(B) | Hikvision | unknown | — |
| DS-2XE6452F-IZH(R)S | Hikvision | unknown | — |
| DS-2XE6482F-IZHRS | Hikvision | unknown | — |
| DS-7104NI-Q1 | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7104NI-Q1/4P | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7104NI-Q1/4P/M | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7104NI-Q1/M | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7108NI-Q1 | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7108NI-Q1/8P | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7108NI-Q1/8P/M | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7108NI-Q1/M | Hikvision | unknown | <= 4.31.100, >= 4.30.300 |
| DS-7604NI-K1 | Hikvision | unknown | — |
| DS-7604NI-K1/4P/4G | Hikvision | unknown | — |
| DS-7604NI-Q1 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7604NI-Q1/4P | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7608NI-K1 | Hikvision | unknown | — |
| DS-7608NI-K1/4G | Hikvision | unknown | — |
| DS-7608NI-K1/8P | Hikvision | unknown | — |
| DS-7608NI-K1/8P/4G | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7608NI-Q1 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7608NI-Q1/8P | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7608NI-Q2 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7608NI-Q2/8P | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-760NI-K1/4P | Hikvision | unknown | — |
| DS-7616NI-K1 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7616NI-Q1 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7616NI-Q2 | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| DS-7616NI-Q2/16P | Hikvision | unknown | <= 4.31.000, >= 4.30.210 |
| IDS-2PT9A144MXS-D/T2 | Hikvision | unknown | — |
| IDS-2SK718MXS-D | Hikvision | unknown | — |
| IDS-2SK8144IXS-D/J | Hikvision | unknown | — |
| IDS-2VS435-F840-EY | Hikvision | unknown | — |
| IDS-2VS435-F840-EY(T3) | Hikvision | unknown | — |
| Ptz-n2204i-de3 | Hikvision | IP camera | — |
| Ptz-n2404i-de3 | Hikvision | IP camera | — |
| Ptz-n4215-de3 | Hikvision | IP camera | — |
| Ptz-n4215i-de | Hikvision | IP camera | — |
| Ptz-n4225i-de | Hikvision | IP camera | — |
| Ptz-n5225i-a | Hikvision | IP camera | — |
References
Vendor advisory and patch
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html exploit
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html exploit
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ third-party
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf exploit
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html exploit
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html exploit
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ third-party
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 government
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.